Solving a Bugforge Challenge — Exploiting LFI in Cafe Club

Today, I solved another challenge on Bugforge, targeting a coffee store web application called Cafe Club.

The application allowed users to:

• Browse coffee-related products
• Add items to cart
• Purchase products
• Earn loyalty points after each purchase

At first glance, the challenge appeared to focus on loyalty point abuse or business logic flaws. However, deeper inspection revealed a Local File Inclusion (LFI) vulnerability.

Initial Exploration

While browsing product details, I noticed that product images were loaded through an API endpoint structured like:

/api/product/image?file=/images/imagename.png

This immediately caught my attention.

Whenever a file path is passed as a parameter, it becomes a potential attack surface for Path Traversal / LFI.

Testing for File Inclusion

To confirm whether the application validated file paths properly, I began modifying the file parameter.

Attempt 1:

/flag.txt

No output was returned.

This suggested that either:

• Absolute paths were restricted
• The flag was not in the root directory

• Or traversal was required

Directory Traversal Attempt

I then tested a relative path:

../flag.txt

This time, the server responded with the contents of the flag file.

This confirmed a Local File Inclusion via Path Traversal vulnerability.

The application failed to properly sanitize or restrict the file path parameter.

Verifying with an LFI Script

After manually confirming the vulnerability, I used a simple Python-based LFI testing script as an alternative method to fetch the file.

The script allowed me to:

• Input file paths interactively
• Send requests directly to the vulnerable endpoint
• Display the server response

Using the same traversal path:

../flag.txt

The script successfully retrieved the flag again.

This confirmed the vulnerability was consistent and reproducible outside of manual proxy testing.

Why This Worked

The vulnerability existed because:

• User-controlled input was directly used in file path construction
• No path normalization or sanitization was applied
• Directory traversal sequences (../) were not filtered
• The application did not restrict access to a safe directory

This allowed access to sensitive files outside the intended /images/ directory.

Security Lessons Learned

This challenge highlights important file handling principles:

• Never trust user-supplied file paths
• Always normalize and validate file paths
• Restrict file access to a specific directory (whitelisting)
• Filter or block traversal sequence.
• Avoid exposing internal file structure via API endpoints

LFI vulnerabilities can lead to:

• Sensitive file disclosure
• Credential leakage
• Configuration exposure

Final Thoughts

This Bugforge challenge reinforced how seemingly harmless features like image loading can introduce serious vulnerabilities.

At first glance, the challenge appeared to revolve around loyalty logic. However, careful inspection of API endpoints revealed a deeper flaw.

Manual testing uncovered the vulnerability. The LFI script validated and streamlined exploitation.

Another reminder that whenever file paths are user-controlled, careful security testing is essential.